<html>
<head><meta charset="utf-8"><title>Pin destructor · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html">Pin destructor</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="178838160"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/178838160" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#178838160">(Oct 23 2019 at 09:49)</a>:</h4>
<p>Can <code>Pin::drop</code> panic ? and if so, which invariants should that maintain ?</p>



<a name="178838323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/178838323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#178838323">(Oct 23 2019 at 09:51)</a>:</h4>
<p><a href="https://doc.rust-lang.org/std/pin/#drop-guarantee" target="_blank" title="https://doc.rust-lang.org/std/pin/#drop-guarantee">https://doc.rust-lang.org/std/pin/#drop-guarantee</a> and the section below only require that memory is not deallocated until drop gets called</p>



<a name="178838378"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/178838378" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#178838378">(Oct 23 2019 at 09:52)</a>:</h4>
<p>but if the drop call panics, the memory of the pin will be deallocated, e.g., via unwinding</p>



<a name="178838458"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/178838458" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#178838458">(Oct 23 2019 at 09:53)</a>:</h4>
<p>So AFAICT <code>Pin::drop</code> needs to make sure that, in the presence of a <code>panic!</code>, no references to the memory outlive the <code>Pin</code></p>



<a name="179745250"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179745250" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179745250">(Nov 03 2019 at 12:22)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> good question... <span class="user-mention" data-user-id="203289">@boats</span> any thoughts?</p>



<a name="179745261"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179745261" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179745261">(Nov 03 2019 at 12:23)</a>:</h4>
<p>this seems worth opening an issue about -- not sure on which tracker though. if UCG = R-AM, then this is out of scope as its library UB. So likely the main rust issue tracker?</p>



<a name="179818339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179818339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179818339">(Nov 04 2019 at 09:45)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> probably in rust-lang/rust</p>



<a name="179818370"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179818370" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179818370">(Nov 04 2019 at 09:45)</a>:</h4>
<p>although it's unclear whether the docs of <code>Pin</code> need to mention this</p>



<a name="179821258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179821258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179821258">(Nov 04 2019 at 10:28)</a>:</h4>
<p>I guess the issue is that the destructor might panic <em>before</em> completing whatever fixups are necessary to put the system in a valid state?</p>



<a name="179821289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179821289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179821289">(Nov 04 2019 at 10:29)</a>:</h4>
<p>It seems like a code correctness issue in creating intrusive data structures</p>



<a name="179821308"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179821308" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179821308">(Nov 04 2019 at 10:29)</a>:</h4>
<p>We could mention it in the intrusive data structures section if there's a succinct way to explain the pitfall.</p>



<a name="179821513"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179821513" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179821513">(Nov 04 2019 at 10:32)</a>:</h4>
<p>(More abstractly, we've only guaranteed that drop gets <em>called</em>, that commitment has been met even if the drop panics, no? libraries are responsible for translating that guarantee into a safe abstraction for their actual purpose)</p>



<a name="179822434"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822434" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822434">(Nov 04 2019 at 10:45)</a>:</h4>
<p>I don't think we guarantee that <code>drop</code> gets called for <code>Pin</code> (we can't really guarantee this)</p>



<a name="179822457"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822457" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822457">(Nov 04 2019 at 10:46)</a>:</h4>
<p><code>Pin</code> requires that <code>drop</code> gets called for safety</p>



<a name="179822520"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822520" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822520">(Nov 04 2019 at 10:46)</a>:</h4>
<p>I think I actually see the point</p>



<a name="179822532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822532">(Nov 04 2019 at 10:46)</a>:</h4>
<p>The thing is <code>Pin</code> probably also requires that the <code>drop</code> of the <code>T</code> does not panic</p>



<a name="179822551"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822551" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822551">(Nov 04 2019 at 10:46)</a>:</h4>
<p>So we tell users who receive a <code>Pin&lt;P&gt;</code> that the destructor of <code>P::Target</code> will be called before <code>P::Target</code>'s memory becomes invalid</p>



<a name="179822568"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822568" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822568">(Nov 04 2019 at 10:47)</a>:</h4>
<p>yes</p>



<a name="179822582"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822582" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822582">(Nov 04 2019 at 10:47)</a>:</h4>
<p>However, its possible if <code>P</code>'s drop panics, that the destructor of <code>P::Target</code> won't be called, but the memory is invalid</p>



<a name="179822592"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822592" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822592">(Nov 04 2019 at 10:47)</a>:</h4>
<p>is that true / what you're talking about? (hard to reason about the drop glue and panics)</p>



<a name="179822644"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822644" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822644">(Nov 04 2019 at 10:48)</a>:</h4>
<p>I don't have a small reproducer of this, but I suspect one can write one</p>



<a name="179822658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822658">(Nov 04 2019 at 10:48)</a>:</h4>
<p>Yes its true</p>



<a name="179822664"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822664" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822664">(Nov 04 2019 at 10:48)</a>:</h4>
<p>Or, let's say its true</p>



<a name="179822674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822674">(Nov 04 2019 at 10:48)</a>:</h4>
<p>A similar example is if <code>P</code> implements <code>Deref</code> but doesn't actually involve pointer indirection, like <code>ManuallyDrop</code> does</p>



<a name="179822693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822693">(Nov 04 2019 at 10:49)</a>:</h4>
<p>However, this is also why there's no generic safe constructor for a <code>Pin&lt;P&gt;</code></p>



<a name="179822724"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822724" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822724">(Nov 04 2019 at 10:49)</a>:</h4>
<p>There are a few things we can say about this (though they are basically all libs issues, since its about how to correctly use this unsafe std API, and not language semantics)</p>



<a name="179822787"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822787" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822787">(Nov 04 2019 at 10:50)</a>:</h4>
<p>Yes, this would be another requirement of <code>Pin</code> for safety</p>



<a name="179822807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822807">(Nov 04 2019 at 10:50)</a>:</h4>
<p>Well, I think there's one obvious correct one: if you create a safe constructor for <code>Pin&lt;P&gt;</code>, you must ensure that <code>P</code>'s behavior upholds pin's drop guarantees</p>



<a name="179822831"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822831" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822831">(Nov 04 2019 at 10:50)</a>:</h4>
<p>so the incorrectness would be in the code that created a <code>Pin&lt;P&gt;</code> where <code>P</code>s destructor panics</p>



<a name="179822844"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822844" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822844">(Nov 04 2019 at 10:51)</a>:</h4>
<p>The writer of <code>P</code> needs to make sure that if <code>P::drop</code> panics, deallocating <code>P</code> is safe.</p>



<a name="179822860"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822860" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822860">(Nov 04 2019 at 10:51)</a>:</h4>
<p>well, the writer of the code that makes a <code>Pin&lt;P&gt;</code>, <code>P</code> could come from another library that never thought about pinning at all</p>



<a name="179822924"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822924" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822924">(Nov 04 2019 at 10:52)</a>:</h4>
<p>I think a new section about defining safe constructors could be useful info, though it reaches the point where maybe some of this should go into the nomicon instead of the main pin docs</p>



<a name="179822927"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822927" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822927">(Nov 04 2019 at 10:52)</a>:</h4>
<p>Hm, I thought that the writer of <code>P</code> already needed to consider the possiblity of <code>P</code> being pinned when providing a drop impl for <code>P</code></p>



<a name="179822938"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179822938" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179822938">(Nov 04 2019 at 10:52)</a>:</h4>
<p>Definitely not, because there's no safe way to pin an unknown pointer type</p>



<a name="179823041"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823041" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823041">(Nov 04 2019 at 10:54)</a>:</h4>
<p>But, e.g.,<code>Box</code> would need to consider this right ?</p>



<a name="179823057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823057">(Nov 04 2019 at 10:54)</a>:</h4>
<p>In std, we needed to consider it when we added the <code>Box::pin</code> constructor</p>



<a name="179823067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823067">(Nov 04 2019 at 10:54)</a>:</h4>
<p>That is, if you want to provide safe pinning for your type, then you need to consider what happens when your type destructor panics, and make sure that everything is still safe.</p>



<a name="179823097"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823097" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823097">(Nov 04 2019 at 10:55)</a>:</h4>
<p>Yes its true, I'm just saying that whoever decided to "provide safe pinning" is responsible, not whoever wrote the type (if they're separate libraries, they also need to make sure the guarantees they're relying on will be maintained in perpetuity)</p>



<a name="179823104"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823104" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823104">(Nov 04 2019 at 10:55)</a>:</h4>
<p>It's a distinction without a difference in practice</p>



<a name="179823114"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823114" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823114">(Nov 04 2019 at 10:55)</a>:</h4>
<p>Ah, sure, the distinction makes sense, thanks.</p>



<a name="179823175"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823175" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823175">(Nov 04 2019 at 10:56)</a>:</h4>
<p>So that's why I think this and the ManuallyDrop example could go together under a section on defining safe constructors for pinned pointers</p>



<a name="179823178"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823178" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823178">(Nov 04 2019 at 10:56)</a>:</h4>
<p>I think it would be better to have a minimum working example showing the problem before trying to come up with some docs for this</p>



<a name="179823206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823206">(Nov 04 2019 at 10:57)</a>:</h4>
<p>Yes, that makes sense. With ManuallyDrop one can create this same issue, without having to explain how panicking in destructors works.</p>



<a name="179823338"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823338" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823338">(Nov 04 2019 at 10:59)</a>:</h4>
<p>one thing worth noting also is that <em>because</em> this is a requirement of creating a constructor, generic code like <code>Pin&lt;P&gt; where P::Target = MyType</code> is correct</p>



<a name="179823352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823352">(Nov 04 2019 at 10:59)</a>:</h4>
<p>you can assume that that type upholds the pinning guarantee, even though the pointer type is abstract</p>



<a name="179823522"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823522" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823522">(Nov 04 2019 at 11:02)</a>:</h4>
<p>so I was trying to think of a practical situation where this would be an issue, but panic in destructors is weird</p>



<a name="179823529"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179823529" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179823529">(Nov 04 2019 at 11:02)</a>:</h4>
<p>it means something failed while dropping a type, so how can you then make sure that your type is ok to deallocate ?</p>



<a name="179913357"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179913357" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179913357">(Nov 05 2019 at 09:12)</a>:</h4>
<blockquote>
<p>However, its possible if <code>P</code>'s drop panics, that the destructor of <code>P::Target</code> won't be called, but the memory is invalid</p>
</blockquote>
<p>well the question is if this is legal, or if we require callers to not free memory in this case. but the latter seems unrealistic.</p>



<a name="179913379"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179913379" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179913379">(Nov 05 2019 at 09:12)</a>:</h4>
<p>so, basically the safety requirement for <code>drop</code> of something pinned is that once drop returns <em>or</em> unwinds, the backing store must be safe to deallocate</p>



<a name="179913421"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179913421" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179913421">(Nov 05 2019 at 09:13)</a>:</h4>
<p>"you must call <code>drop</code> before invalidating memory" is really just a different way of saying that (a) deallocating memory requires full ownership of that memory, and (b) for pinned stuff, you don't have that ownership -- but you can get it by calling <code>drop</code></p>



<a name="179913486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/179913486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#179913486">(Nov 05 2019 at 09:14)</a>:</h4>
<p><span class="user-mention" data-user-id="203289">@boats</span> ^</p>



<a name="180060801"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/180060801" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#180060801">(Nov 06 2019 at 18:14)</a>:</h4>
<p>That seems like a good way to explain the situation, though I'd always want to be clear that nothing at the language level is happening here.</p>



<a name="180905713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/180905713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#180905713">(Nov 16 2019 at 09:52)</a>:</h4>
<p><span class="user-mention" data-user-id="203289">@boats</span>  nothing at the R-AM level is happening here. if you consider the "meaning" of primitive Rust types to be part of the language, then that <em>is</em> involved here. There's a reason that supporting <code>Pin</code> in the RustBelt formalization of the type system is a global change that affects <em>all</em> types.</p>



<a name="180905720"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin%20destructor/near/180905720" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Pin.20destructor.html#180905720">(Nov 16 2019 at 09:53)</a>:</h4>
<p>as for panics, should we try to somehow put this into the docs? it's a really subtle point but also I don't know where else to put it.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>